03 / 05
TechDevX Identity
- Role
- Founder and engineer
- Company
- TechDevX
- Year
- 2026
- Built with
- TypeScript, Next.js, Hono, Better Auth, OpenID Connect, PostgreSQL, Prisma, Stripe, and Docker
TaxHacker sends the user to /oidc/auth with a PKCE challenge.
Overview
Every TechDevX app needs accounts, so instead of rebuilding sign-in each time I built one identity service they all share. TaxHacker on the web and the Vault Finance mobile app send users to it and get back signed tokens. One install serves many organisations, each with its own subdomain, branding and users, and it’s also where each user’s paid plan lives.
How a sign-in works
- 01TaxHacker sends the user to /oidc/auth with a PKCE challenge.
- 02The hosted login signs them in: password, magic link, or Google, GitHub or Apple.
- 03The session and an audit event are saved in Postgres; emails go out through Resend.
- 04The app swaps a one-time code for RS256-signed tokens and checks them against the JWKS.
- 05Stripe plans arrive as an entitlement claim, and the mobile app shares the same accounts.
What I did
- 01Designed and built the identity provider end to end, from spec to production
- 02Implemented OpenID Connect with PKCE, RS256-signed tokens and a public JWKS
- 03Built organisations, per-app branding and an admin console for apps, users and billing
- 04Turned Stripe plans into token entitlements and signed webhooks for client apps
- 05Hardened production: audit log, rate limits, locked-down containers, secret scanning
Standards, not a homemade token
It’s a real OpenID Connect provider, built on Better Auth and the panva OIDC library rather than custom crypto. Apps use the authorization-code flow with PKCE, ID tokens are signed RS256 and verified against a public JWKS, and mobile apps can use bearer tokens with native Apple and Google sign-in.
Every way people expect to sign in
Email and password with required verification, magic links that also hand off to native apps, password reset, and Google, GitHub and Apple, with account linking only between verified emails. Apps the platform doesn’t trust get a consent screen; anything short of an explicit allow is a deny.
Many organisations, one install
Each organisation is resolved from its subdomain and gets its own branding and user base. Every database query is scoped to the organisation, and an isolation test suite checks that one tenant can never read another’s data. Admins manage apps, users and billing from one console.
Secure by default
Sign-in and reset endpoints are rate limited, every auth event goes to an append-only audit log, and responses never reveal whether an email exists. In production the containers drop all privileges, the web container is read-only with no internet access, and around 400 automated tests cover the flows, including Playwright runs of the full OIDC login.
Product names and imagery belong to TechDevX.